CVE-2015-2312
HighSummary
Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service via a list with a large number of elements.
Risk Assessment
Attackers can exploit this vulnerability to exhaust CPU and possibly other system resources, leading to application downtime.
Recommendation
It is recommended to update Sandstorm Cap'n Proto to the latest version to mitigate the risk associated with this vulnerability.
Other vulnerabilities in Sandstorm Cap'n Proto
See all- CVE-2015-2313High
In Sandstorm Cap'n Proto versions before 0.4.1.1 and 0.5.x before 0.5.1.2, the totalSize method on an object reader can be exploited by remote peers to cause a denial of service through a crafted small message, leading to high CPU consumption.
- CVE-2017-7892High
Sandstorm Cap'n Proto before 0.5.3.1 allows remote crashes related to a compiler optimization. A remote attacker can trigger a segfault in a 32-bit libcapnp application due to overflow in pointer arithmetic calculations.
- CVE-2015-2311Critical
An integer underflow in Sandstorm Cap'n Proto before version 0.4.1.1 and 0.5.x before 0.5.1.1 may allow remote peers to cause a denial of service or potentially obtain sensitive information from memory or execute arbitrary code via a crafted message.
- CVE-2015-2310Critical
Integer overflow in layout.c++ in Sandstorm Cap'n Proto before version 0.4.1.1 and 0.5.x before version 0.5.1.1 allows remote peers to cause a denial of service or possibly obtain sensitive information from memory via a crafted message, related to pointer validation.
Original NVD description (English source)
Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service (CPU and possibly general resource consumption) via a list with a large number of elements.